DE102012201185A1 - Method for operating at least two data processing units with high availability, in particular in a vehicle, and device for operating a machine - Google Patents

Abstract

A method for operating at least two high-availability data processing units (VCC1, VCC2), in particular in a vehicle, is explained. A first data processing unit (VCC1) and a second data processing unit (VCC2) can each perform at least 60 percent or at least 90 percent of the same function. The second data processing unit (VCC2) automatically removes at least one memo (120, 122) for a process to be executed from a memory unit or automatically switches to an idle state.

Description

The invention relates to a method for operating at least two data processing units, in short DV units, with high availability, in particular in a vehicle. A first DV unit and a second DV unit can each perform at least one equal function or at least 10 percent of the same functions. Typically, the DV units provide at least 60 percent or at least 90 percent perform the same functions, based on, for example, the machine code of the first DV unit. Both units carry out, for example, the same steps. In the event of an error, for example, a shutdown of the automatic control of the machine, e.g. a car, with transition to manual control or switching to retreat procedures in which, for example, only one of the two DV units works. Moreover, the invention relates to an associated apparatus for operating a machine.

It is an object of the invention to provide a method which, despite the presence of high redundancy, i. Availability, energy efficient. In addition, a corresponding device should be specified.

The object related to the method is achieved by a method having the method steps specified in claim 1. Further developments are specified in the subclaims.

In the method, the second data processing unit can automatically remove at least one note for a process to be executed from a memory unit or automatically put into a sleep state.

Thus, the decision to switch off the redundancy is made internally in the second data processing unit, in short unit. The second unit is subordinate to the first unit in this case in terms of redundancy. If the decision to switch off the redundancy is incorrect, this is intercepted by the overall concept of redundancy or fault tolerance, according to which an error can occur in one of the two units.

In particular, the switching off of the redundancy is therefore not initiated externally, e.g. through the first unit. If, in this case, the decision to switch off would be incorrect, then the wrong decision beyond the first unit would also propagate to the second DV unit, which contradicts a basic concept of fault tolerance.

Also in the first DV unit, at least one note for a process to be performed may be automatically removed from a memory unit by the first DV unit or the first DV unit may automatically go to sleep mode, in which case the first DV unit would be subordinate in terms of redundancy, eg Slave unit in a master / slave relationship of the two DV units.

In both units, the same machine code can be stored, which results in a redundancy of 100 percent.

In the method thus not both units are switched off, but only one of the two units. The shutdown is preferably not due to a fault of the second unit, as this is still fully functional, but for other reasons. One such reason is, for example, the reduction of power consumption. A small power consumption is particularly important for an electric vehicle or a hybrid vehicle with electric motor and internal combustion engine in the drive unit to increase the range of the electric motor drive. But even with a vehicle that contains only one internal combustion engine in the drive unit, a reduction in power consumption can lead to a reduction in fuel consumption. The shutdown takes place, for example, by switching off the power to the unit or by disconnecting the unit from its power supply. Alternatively, the processors of the unit can be switched off.

The same applies to removing the note for the process to be performed. The note is removed, although the process could be completed without error. Removing the note causes the process to run only from the first unit. The second unit no longer executes the process, which reduces the required computing power. If a plurality of processes are not carried out in this way, e.g. more than 10 or even more than 100, the required computing power can be significantly reduced, which has an effect on the power consumption of a processor of the second unit. A process monitoring of the second unit, after removing the endorsements for a sufficient number of processes, may even lead to the result that the processor of the second unit or the second unit can be completely switched off or put into an idle state. Alternatively, there may be several quiescent states, each with reduced energy consumption compared to the previous quiescent state.

The power consumption of a processor can range from 15 to 50 watts. If, for example, a processor is switched off for a total of one hour, then 50 watt-hours are saved. This uses the available energy efficiently.

The removal of the notes takes place, for example, by changing the data value of a memory cell, for example a date which indicates whether the relevant process should be executed or not.

The removal of the notes or the putting into the idle operating state can take place depending on the operating state of a machine, for whose operation the DV units are used, in particular a transport machine.

The transport machine may be a vehicle, e.g. an electric vehicle, a hybrid vehicle, or a vehicle powered only by an internal combustion engine. There are vehicles of any size in question, i. Commercial vehicles, especially trucks, buses, passenger cars, motorcycles, bicycles, etc. The transport machine may also be an aircraft, boat or ship.

The operating state can be detected in a simple manner with the aid of at least one sensor unit, in particular with a motion sensor, a speed sensor or a speed sensor. The sensor unit operates, for example, mechanically and / or electronically.

The operating state may be the state "hold", "charge a battery", the state "drive" or another operating state. The state "driving" can in particular be divided into at least two substates, eg. In the low speed driving, medium speed driving and high speed driving states. The upper limit for the low speed is, for example, in the range of 3 km / h (kilometers per hour) to 10 km / h. The lower limit for the high speed is, for example, in the range of 50 km / h to 80 km / h or even up to 100 km / h.

The safety requirements, for example, on the protection of occupants or persons and thus on the reliability of technical systems differ considerably within these areas. The respective required reliability of electronic devices can be taken into account by using these areas in a simple way even when switching off redundancy.

The data processing units can be operated on a data transmission network with a data transmission protocol that enables the switching on of processors or network units / transmission units, in particular on an Ethernet.

In the case of an Ethernet, for example, there is the option of a "Wake on LAN" (Local Area Network), with which the second unit can be switched on again in a simple manner after switching off. For example, after turning on the second unit, booting automatically starts, loading a basic input operation system (BIOS) from read-only memory into fast memory followed by loading central portions of an operating system into fast memory or other fast memory.

Alternatively, however, in another way than via the data transmission network or the data transmission networks, a power supply circuit can be switched on or switched on again, for example via a relay or via a transistor.

The switching on can take place as a function of a detected operating state of the machine, for example a speed change of a transport machine, in particular for passenger transport, including a driver.

The turn-on can be controlled from the outside as opposed to the turn-off, i. from a unit other than the second unit, because a miss on power-up causes the redundancy to be increased by turning on the second unit. The second unit would then, for example, turn off again.

The removed comment can be automatically entered again by the second data processing unit, for example, depending on the current operating state of the machine. This can be done by the second DV unit, if the second DV unit has not yet been completely switched off or after switching off and then switching on the second DV unit. In both cases, the removed notes, for example, have been temporarily stored elsewhere to facilitate re-entry.

The idle state may be a state in which the power supply of the second data processing unit is turned off or in which the second data processing unit is disconnected from its power supply. When switching on the second DV unit then reboots, but this can be done within, for example, less than 50 ms (milliseconds) or within a time less than 100 ms.

The idle state may be terminated by the first data processing unit, in particular by causing the turning on of a power supply of the second data processing unit or by causing the power supply of the second DV unit to be connected to the second DV unit, e.g. a central power supply.

The power supply takes place, for example, using a separate switching power supply and / or a circuit for voltage stabilization.

Each data processing unit may each contain at least two processors. These processors can also be part of separate sub-processing units, in short subunits. The two processors can perform the same functions to create redundancy within the first unit and the second unit, respectively. The goal is to achieve a high error self-detection per DV unit. For example. The machine code in a subunit memory is 100 percent consistent, at least 90 percent, or at least 60 percent. The processors of the sub-units of a data processing unit check their processing results, for example, mutually. Only if the results match, the data belonging to these results will be processed in another DV unit.

This results in a total of at least four redundant processors, which is currently considered sufficient for control functions related to the safety of persons. For reasons of computing capacity, additional processors can be provided in the data processing units.

The two data processing units can each be connected to two identically structured data transmission connections or data processing networks. This can also be ensured in the data transmission high availability and high security against Überragungsfehler.

For example. The data can be transmitted via two different paths, for example via two bus systems or over two network levels, preferably along different transmission directions, for example in a ring topology.

The data transmission can be wired, fiber-bound or wireless. The data transfer can be synchronous or asynchronous. In particular, messages are used in data transmission, which are provided in data transmission protocols, eg Ethernet protocol according to IEEE (Institute of Electrical and Electronics Engineers Inc.) 802.3 , TCP / IP (Transmission Control Protocol) / (Internet Protocol) according to the RFCs (Request For Comment) of the IETF (Internet Engineering Task Force).

• – doppelt ausgeführter CAN-Bus (Controller Area Network),
• – TTP (Time Triggered Protocol),
• – TTE (Time Triggered Ethernet),
• – PROFINET (PROcess FIeld NETwork) ggf. mit IRT (Isochronous Real Time), oder
• – FlexRay-Bus.

But also in the automotive industry common bus system are used, for example:

• - double executed CAN bus (Controller Area Network),
• TTP (Time Triggered Protocol),
• TTE (Time Triggered Ethernet),
• - PROFINET (PROcess FIeld NETwork), if necessary with IRT (Isochronous Real Time), or
• - FlexRay bus.

Furthermore, proprietary protocols are used.

• – Vorgabe von Lenkwinkeln,
• – Vorgabe von Bremsbefehlen,
• – automatische Abstandskontrolle,
• – Regelung eines elektrischen Antriebsmotors, bspw. unter Verwendung einer feldorientierten Regelung.

The two data processing units can provide at least one core function for controlling or regulating the machine. Core functions are, for example:

• - specification of steering angles,
• - specification of brake commands,
• - automatic distance control,
• - Control of an electric drive motor, eg. Using a field-oriented control.

The core functions can be provided centrally in the machine or in the vehicle. But even a distributed execution of the core functions is possible, or a version elsewhere.

• – Umsetzung eines Lenkwinkeldatums in eine Lenkbewegung, wobei eine Lenkung automatisch betätigt wird,
• – automatisches Betätigen einer Bremse,
• – automatische Ansteuerung eines Verbrennungsmotors, bspw. Betätigen eines Ventils oder einer Drosselklappe,
• – automatische Ansteuerung eines Elektromotors für den Antrieb.

The two data processing units can alternatively provide functions in at least one peripheral subsystem of the machine. Peripheral subsystems are, for example, actuators, eg:

• Conversion of a steering angle datum into a steering movement, whereby a steering is automatically actuated,
• - automatic operation of a brake,
• Automatic control of an internal combustion engine, for example actuation of a valve or a throttle valve,
• - Automatic control of an electric motor for the drive.

The object related to the device is solved by the device explained below. Further developments are specified in the subclaims.

• – eine erste Datenverarbeitungseinheit, und
• – eine zweite Datenverarbeitungseinheit, wobei die erste Datenverarbeitungseinheit und die zweite Datenverarbeitungseinheit jeweils mindestens eine gleiche Funktion erbringen bzw. mindestens 10 Prozent gleiche Funktionen. Typischerweise werden zu mindestens 60 Prozent oder zu mindestens 90 Prozent oder sogar zu 100 Prozent die gleichen Funktionen erbracht, sowie
• – eine erste Steuereinheit in der zweiten Datenverarbeitungseinheit, wobei die erste Steuereinheit mindestens einen Vermerk für einen auszuführenden Prozess aus einer Speichereinheit entfernt oder die zweite Datenverarbeitungseinheit automatisch in einen Ruhezustand versetzt.

The device for operating a machine includes:

• A first data processing unit, and
• - A second data processing unit, wherein the first data processing unit and the second data processing unit each perform at least one same function or at least 10 percent of the same functions. Typically, at least 60 percent or at least 90 percent or even 100 percent perform the same functions, as well
• A first control unit in the second data processing unit, the first one Control unit removes at least one note for a process to be executed from a storage unit or automatically put the second data processing unit in an idle state.

The technical effects mentioned above for the method apply. By switching off redundancy, energy can be used efficiently. Also, the first unit may include a corresponding control unit for switching off redundancy.

The device may include a first memory unit in the first data processing unit, wherein it is noted in the memory unit that the first data processing unit takes precedence over the second data processing unit with regard to the provision of the functions or with respect to the redundancy.

Also in the second unit there may be a memory unit in which it is then noted that the second DV unit is subordinate to the first unit. Thus, the master / slave principle can be used here.

• – erste Datenübertragungsverbindung, kurz DÜ Verbindung, oder erstes Datenverarbeitungsnetz, und
• – zweite Datenübertragungsverbindung oder zweites Datenübertragungsnetz.

The device may include the following technical features:

• - First data transmission connection, short DÜ connection, or first data processing network, and
• - Second data transmission connection or second data transmission network.

The first data processing unit and the second data processing unit may be connected to the first DÜ connection and to the second DÜ connection, wherein at least 60 percent of the data to be transmitted or at least 90 percent of the data to be transmitted or even all data to be transmitted over both data transmission links or both Data transmission networks are transmitted.

Thus, the data transmission is redundant and thus highly available. In particular, data transmission protocols according to the abovementioned standards or de facto standards are used, in particular also proprietary protocols.

The above-described characteristics, features, and advantages of this invention, as well as the manner in which they are achieved, will become clearer and more clearly understood in connection with the following description of the embodiments. If the term "can" is used in this application, it is both the technical possibility and the actual technical implementation.

In the following, embodiments of the invention will be explained with reference to the accompanying drawings. Show:

1 central and peripheral computers in a vehicle,

2 the switching on and off of computers in the vehicle depending on different operating states,

3 a method for switching on and off computers,

4 Process tables listing processes to be executed

5 a process for switching processes on and off, and

6 the construction of a central data processing unit of a vehicle, which is operated on an Ethernet.

A redundancy switch-off in the standby mode of vehicles is explained. Alternatively, the redundancy shutdown can also be performed in an aircraft or in another machine.

When safety-critical components in vehicles, e.g. Steering or braking, no longer be controlled mechanically or hydraulically, i. the control is, for example, carried out electrically, there must be a redundant path which, in the event of an error, e.g. in a CPU (Central Processing Unit), power line, communication line, random access memory (RAM), calculation method / function, etc., which can take control. Should this fallback level also not be a mechanical fallback level, the electrical control itself must be redundant. This means that the electrical lines are duplicated and also the calculations for the control functions or control functions are performed twice and on several cores in order to detect random errors in the cores themselves.

In the case of a duo-duplex structure, this means that in addition to multi-channel lines, four processor cores are used. Therefore, a high energy requirement is required here, ie up to four times the energy consumption without redundant control. The redundancy is not needed in all situations. However, the systems in the vehicle can not be switched off completely. For example. must be active when parking the vehicle systems. However, this is not safety-critical. Rather, it comes here in standby to ensure that as little energy is consumed, so that the vehicle over a longer Period does not have to be operated (eg when parking). The same applies to triplex structures.

Up to now, in the field of vehicles no purely electrical control of safety-critical systems in a central architecture has been used as standard. X-by-wire solutions can, for example, only be designed for individual subsystems. The entire subsystem can then be switched off while parking.

In a vehicle's central E / E architecture (electrical / electronic architecture), the components are designed to be able to operate in a duo-duplex or triplex architecture. You can be awakened by a non-redundant wake-up call. In standby only the necessary functions are executed and all others are not calculated. The redundant computer cores are switched off as long as the remaining active functions do not require redundancy. The calculations and the necessary communication are only one-channel. Once the redundancy is needed again, the cores are automatically booted and synchronized: the communication is again multi-channel. The subsystems and functions that are still not needed will remain inactive and will not operate redundantly.

The E / E architecture does not have to be redundant for the safety-critical systems for every state of a vehicle. For certain states, eg. As parking, redundancy can be dispensed with, for other states redundancy is required only in subsystems. If no redundancy is required, the energy requirement is reduced.

Standby modes for central control units, such as redundant cores, are made possible without having to install extra devices or subsystems for this mode. Standby times are increased. The period up to which the battery has to be recharged is extended.

If the system can independently start up the components necessary for redundancy, the vehicle can perform safety-critical functions even without direct supervision of the user (e.g., remotely controlled charging or discharging operations).

An embodiment can also be the use of n> 2 duplex systems: n-duplex computers (with n times 2 cores per duplex unit), where n is a natural number.

The 1 shows central and peripheral computers in a vehicle, especially in an accumulator-powered or battery-powered vehicle, electric car. The vehicle contains a central on-board computer 10 and further arithmetic units.

• – eine erste zentrale Steuereinheit VCC1, und
• – eine zweite zentrale Steuereinheit VCC2.

The central on-board computer 10 includes:

• A first central control unit VCC1, and
• A second central control unit VCC2.

• – eine erste Lenksteuerungseinheit Sbw1 (Stear by wire),
• – eine zweite Lenksteuerungseinheit Sbw2,
• – eine erste Bremssteuerungseinheit Bbw1 (Break by wire),
• – eine zweite Bremssteuerungseinheit Bbw2, sowie
• – weitere nicht dargestellte Einheiten, die redundant oder einfach ausgeführt sind.

Other computing units include:

• A first steering control unit Sbw1 (stear by wire),
• A second steering control unit Sbw2,
• A first brake control unit Bbw1 (break by wire),
• - A second brake control unit Bbw2, as well
• - Other unillustrated units that are redundant or simple.

Furthermore, there is a first data transmission network DT1 and a second data transmission network DT2, which the on-board computer 10 and connect the other arithmetic units.

• – einen Prozessor Pr1 und einen Prozessor Pr2, bspw. Mikroprozessoren, die Programmbefehle abarbeiten, die in nicht dargestellten Speichereinheiten gespeichert sind,
• – zwei Übertragungseinheiten N1a, N1b, mit deren Hilfe eine Verbindung von und zu den Prozessoren Pr1 und Pr2 zu den Datenübertragungsnetzen DT1, DT2 hergestellt wird.

The first central control unit VCC1 contains:

• A processor Pr1 and a processor Pr2, for example microprocessors, which execute program instructions which are stored in memory units, not shown,
• Two transmission units N1a, N1b, by means of which a connection to and from the processors Pr1 and Pr2 to the data transmission networks DT1, DT2 is established.

When using an Ethernet, the transmission units N1a, N1b are formed, for example, by two so-called switches, which are described below with reference to FIG 6 will be explained in more detail. However, other networks are also usable, in particular using the protocols mentioned in the introduction.

• – einen Prozessor Pr3 und einen Prozessor Pr4, bspw. Mikroprozessoren, die Programmbefehle abarbeiten, die in nicht dargestellten Speichereinheiten gespeichert sind,
• – zwei Übertragungseinheiten N2a, N2b, mit deren Hilfe eine Verbindung von und zu den Prozessoren Pr3 und Pr4 zu den Datenübertragungsnetzen DT1, DT2 hergestellt wird. Die Übertragungseinheiten N2a, N2b sind bspw. wie die Übertragungseinheit N1a, N1b aufgebaut.

The second central control unit VCC2 contains:

• A processor Pr3 and a processor Pr4, for example microprocessors, which execute program instructions which are stored in memory units, not shown,
• Two transmission units N2a, N2b, by means of which a connection is established from and to the processors Pr3 and Pr4 to the data transmission networks DT1, DT2. The transmission units N2a, N2b are constructed, for example, like the transmission unit N1a, N1b.

• – zentrale Funktionen für die Lenkung, wobei bspw. ein einzustellender Lenkwinkel ausgegeben wird,
• – zentrale Funktionen für ein Fahren auf Abstand, wobei bspw. Beschleunigung- oder Abbremsdaten erzeugt werden,
• – zentrale Funktionen für einen automatischen Bremsvorgang, z.B. im Rahmen eines ABS (Anti Blockier System),
• – zentrale Funktionen einer Antischlupfregelung (ASR),
• – zentrale Funktionen eines Stabilisierungsverfahrens ESP (Elektronisches Stabilisierungs-Programm),
• – die Regelung eines Elektromotors, der als Antrieb für ein Elektrofahrzeug verwendet wird,
• – zentrale Teile einer elektronischen Bremskraftverteilung (EBV).

The first central control unit VCC1 and the second central control unit VCC2 provide For example, at least one or all of the following functions are redundant:

• Central functions for the steering, wherein, for example, a steering angle to be set is output,
• Central functions for driving at a distance, whereby, for example, acceleration or deceleration data are generated,
• - central functions for an automatic braking process, eg as part of an ABS (Anti-Blocking System),
• - central functions of traction control (ASR),
• - central functions of a stabilization procedure ESP (Electronic Stabilization Program),
• The control of an electric motor used as a drive for an electric vehicle,
• - Central parts of an electronic brake force distribution (EBV).

• – einen Prozessor Pr5 und einen Prozessor Pr6, bspw. Mikroprozessoren, die Programmbefehle abarbeiten, die in nicht dargestellten Speichereinheiten gespeichert sind,
• – zwei Übertragungseinheiten N3a, N3b, mit deren Hilfe eine Verbindung von und zu den Prozessoren Pr5 und Pr6 zu den Datenübertragungsnetzen DT1, DT2 hergestellt wird.

The first steering control unit Sbw1 includes:

• A processor Pr5 and a processor Pr6, for example microprocessors, which execute program instructions which are stored in storage units, not shown,
• Two transmission units N3a, N3b, by means of which a connection is established from and to the processors Pr5 and Pr6 to the data transmission networks DT1, DT2.

• – einen ersten Prozessor Pr7 und einen zweiten Prozessor Pr8, bspw. Mikroprozessoren, die Programmbefehle abarbeiten, die in nicht dargestellten Speichereinheiten gespeichert sind,
• – zwei Übertragungseinheiten N4a, N4b, mit deren Hilfe eine Verbindung von und zu den Prozessoren Pr7 und Pr8 zu den Datenübertragungsnetzen DT1, DT2 hergestellt wird.

The second steering control unit Sbw2 includes:

• A first processor Pr7 and a second processor Pr8, for example microprocessors, which execute program instructions which are stored in memory units, not shown,
• Two transmission units N4a, N4b, by means of which a connection to and from the processors Pr7 and Pr8 to the data transmission networks DT1, DT2 is established.

• – Umsetzung von empfangenen Daten für einen Lenkwinkel in eine Lenkbewegung des Fahrzeugs.

The first steering control unit Sbw1 and the second steering control unit Sbw2 provide the following functions redundantly:

• - Implementation of received data for a steering angle in a steering movement of the vehicle.

• – zwei nicht dargestellte Prozessoren, insbesondere Mikroprozessoren,
• – zwei nicht dargestellte Übertragungseinheiten zur Kopplung der Prozessoren der erste Bremsansteuerungseinheit Bbw1 an die Datenübertragungsnetze DT1, DT2.

The first brake control unit Bbw1 contains:

• Two processors, not shown, in particular microprocessors,
• - Two transmission units, not shown, for coupling the processors of the first brake drive unit Bbw1 to the data transmission networks DT1, DT2.

• – zwei nicht dargestellte Prozessoren, insbesondere Mikroprozessoren,
• – zwei nicht dargestellte Übertragungseinheiten zur Kopplung der Prozessoren der zweiten Bremsansteuerungseinheit Bbw2 an die Datenübertragungsnetze DT1, DT2.

The second brake control unit Bbw2 includes:

• Two processors, not shown, in particular microprocessors,
• - Two transmission units, not shown, for coupling the processors of the second brake drive unit Bbw2 to the data transmission networks DT1, DT2.

• – Betätigen einer Bremse abhängig von zentralen Vorgaben der Steuereinheiten VCC1 bzw. VCC2 bei Ausfall von VCC1,
• – dezentrale Funktionen im Rahmen eines ABS Bremsvorgangs, und
• – dezentrale Funktionen im Rahmen eines ESP Vorgangs.

The first brake control unit Bbw1 and the second brake control unit Bbw2 provide the following functions redundantly:

• - Actuation of a brake depending on central specifications of the control units VCC1 or VCC2 in the event of failure of VCC1,
• - decentralized functions as part of an ABS braking process, and
• - decentralized functions as part of an ESP process.

The data transmission networks DT1, DT2 allow redundant transmission of data between those in the 1 represented units. The data transmission networks DT1, DT2 work on the same transmission protocol, for example. Flex-Ray, double CAN bus or Ethernet, as shown below 6 is explained in more detail.

The 2 shows the switching on and off of computers in the vehicle or electrical system 10 depending on different operating conditions.

An operating condition Z1 relates to the driving of the vehicle, e.g. at medium speed (e.g., in the range of 30 km / h to 60 km / h). An operating condition Z2 relates to the holding of the vehicle, e.g. at a traffic light. The operating state Z2 follows the operating state Z1. If the traffic light switches to green, the operating state Z2 is followed by an operating state Z3 in which the vehicle travels again at medium speed.

• – erste zentrale Steuereinheit VCC1: Prozessor Pr1 eingeschaltet, kurz ein, Prozessor Pr2 ein,
• – zweite zentrale Steuereinheit VCC2: Prozessor Pr3 ein, Prozessor Pr4 ein,
• – erste Lenksteuereinheit Sbw1: Prozessor Pr5 ein, Prozessor Pr6 ein, und
• – zweite Lenksteuereinheit Sbw2: Prozessor Pr7 ein, Prozessor Pr8 ein.

In operating state Z1 the following switching states are present:

• First central control unit VCC1: processor Pr1 switched on, briefly on, processor Pr2 on,
• Second central control unit VCC2: processor Pr3 on, processor Pr4 on,
• First steering control unit Sbw1: processor Pr5 on, processor Pr6 on, and
• Second steering control unit Sbw2: processor Pr7 on, processor Pr8 on.

• – erste zentrale Steuereinheit VCC1: Prozessor Pr1 eingeschaltet, kurz ein, Prozessor Pr2 ein,
• – zweite zentrale Steuereinheit VCC2: Prozessor Pr3 ausgeschaltet, kurz aus, Prozessor Pr4 aus,
• – erste Lenksteuereinheit Sbw1: Prozessor Pr5 ein, Prozessor Pr6 ein, und
• – zweite Lenksteuereinheit Sbw2: Prozessor Pr7 aus, Prozessor Pr8 aus.

In operating state Z2, the following switching states are present:

• First central control unit VCC1: processor Pr1 switched on, briefly on, processor Pr2 on,
• Second central control unit VCC2: processor Pr3 switched off, short off, processor Pr4 off,
• First steering control unit Sbw1: processor Pr5 on, processor Pr6 on, and
• Second steering control unit Sbw2: processor Pr7 off, processor Pr8 off.

In operating state Z3, the switching states mentioned in operating state Z1 are present again.

Thus, in the operating state Z2, the redundancy is reduced to use energy efficiently in a non-critical for the safety of people state. However, at least one system remains activated, here the first central control unit VCC1 or the first steering control unit Sbw1.

The central control units VCC1 and VCC2, the steering control units Sbw1 and Sbw2, as well as the brake control units Bbw1 and Bbw2 may alternatively also be driven as a whole with respect to on and off as opposed to processor related on and off. The switching on and off takes place, for example, by switching on or off power supply units or by disconnecting power supply units or by connecting to power supply units.

The 3 shows a method for switching on and off of computers, with the example. Between the above with reference to the 2 Switching states shown is switched.

The in the 3 shown process steps 102 to 106 are performed in a first variant in the central control unit VCC2. The process steps 108 to 112 on the other hand, in the first variant, they are performed in the central control unit VCC1.

The process begins in one process step 100 , also short as a step 100 designated.

In one step 100 following step 102 the operating state of the vehicle is detected, for example from the second central control unit VCC2.

After the step 102 is from the second central control unit VCC2 the step 104 carried out. In step 104 it is checked whether the vehicle is in operating condition Z2, ie holding. If the vehicle is in Z2 operating state, ie holding, then follow the step 104 immediately a procedural step 106 in which the second control unit VCC2 turns itself off.

On the other hand, if the vehicle is not in operating state Z2, ie holding, then follow the step 104 immediately a procedural step 108 in which the first control unit VCC1 detects the operating state.

In one step 108 following process step 110 the first control unit VCC1 checks whether the state Z1, Z3, ie driving, is active. If the vehicle is in operating state Z1 or Z3, ie driving, then the step follows 110 immediately a procedural step 112 in which the first control unit VCC1 turns on the second control unit VCC2.

If, on the other hand, the vehicle is not in operating state Z1 or Z3, ie driving, the step follows 110 immediately the process step again 102 ,

In a second variant, the in 3 shown method performed for the second steering control unit Sbw2. The in the 3 shown process steps 102 to 106 are performed in the second variant in the second steering control unit Sbw2. The process steps 108 to 112 In contrast, in the second variant Sbw1 performed in the first steering control unit.

The process starts again in one process step 100 , also short as a step 100 designated.

In one step 100 following step 102 the operating state of the vehicle is detected, for example, by the second steering control unit Sbw2.

After the step 102 is from the second steering control unit Sbw2 the step 104 carried out. In step 104 it is checked whether the vehicle is in operating condition Z2, ie holding. If the vehicle is in Z2 operating state, ie holding, then follow the step 104 immediately a procedural step 106 in which the second steering control unit Sbw2 turns itself off.

If the vehicle is not in operation Z2 , ie holding, follow the step 104 immediately a procedural step 108 in which the first steering control unit Sbw1 detects the operating state.

In one step 108 following process step 110 the first steering control unit Sbw1 checks whether the state Z1, Z3, ie driving, is active. If the vehicle is in operating state Z1 or Z3, ie driving, then the step follows 110 immediately a procedural step 112 in which the first steering control unit Sbw1 turns on the second steering control unit Sbw2.

If, on the other hand, the vehicle is not in operating state Z1 or Z3, ie driving, the step follows 110 immediately the process step again 102 ,

In an optional additional process step, for example between the process steps 102 and 104 is, in both variants of the 3 be checked whether there is still a redundancy, ie whether the central control unit VCC1 and the first steering control unit Sbw1 is still fully functional. If so, the method is performed as explained above. On the other hand, if the central control unit VCC1 or the first steering control unit Sbw1 is no longer available, the method is aborted.

That in the 3 The procedure shown is just one example. The same functions can also be achieved by other methods, for example, a method for switching the switching states can be called only when the operating states change, so that the operating states need not be continuously determined. Cyclical queries of the operating states are also possible.

• – Spalte 1, d.h. erste Prozesstabelle, dem Prozessor Pr1,
• – Spalte 2, d.h. zweite Prozesstabelle, dem Prozessor Pr2,
• – Spalte 3, d.h. dritte Prozesstabelle, dem Prozessor Pr3, und
• – Spalte 4, d.h. vierte Prozesstabelle, dem Prozessor Pr4,

The 4 shows process tables showing the processes to be executed. For example. Each column corresponds to a process table, the process tables being assigned to the processors Pr1 to Pr4 as follows:

• Column 1, ie first process table, the processor Pr1,
• Column 2, ie second process table, the processor Pr2,
• - Column 3, ie third process table, the processor Pr3, and
• Column 4, ie fourth process table, the processor Pr4,

• – erste Zeile: eine Funktion F1, die im Beispiel das Lenken betrifft,
• – zweite Zeile: eine Funktion F2, die im Beispiel das Halten einer vorgegebenen Geschwindigkeit betrifft (ACC – Automatic Cruising Control),
• – dritte Zeile: eine Funktion F3, die im Beispiel das Laden eines Akkumulators betrifft, umgangssprachlich auch Akku oder Batterie genannt,
• – vierte Zeile: eine Funktion F4, die im Beispiel das elektronische Stabilisieren ESP des Fahrzeugs betrifft,
• – fünfte Zeile: eine Funktion F5, die im Beispiel die Motorsteuerung betrifft, insbesondere die Reglung eines Elektromotors, und
• – sechste Zeile: eine Funktion F6, die im Beispiel eine Verbindung zu einem Mobilfunknetz betrifft, hier zum UMTS (Universal Mobile Telecommunications System) oder alternativ zu einem LTE Netz (Long Term Evolution).

In the four process tables, the following lines apply to each:

• First line: a function F1, which in the example concerns the steering,
• Second line: a function F2, which in the example concerns the holding of a given speed (ACC - Automatic Cruising Control),
• Third line: a function F3, which in the example relates to the charging of a rechargeable battery, colloquially also called rechargeable battery or battery,
• Fourth line: a function F4, which in the example concerns the electronic stabilization ESP of the vehicle,
• Fifth line: a function F5, which in the example concerns the engine control, in particular the control of an electric motor, and
• - sixth line: a function F6, which in the example relates to a connection to a mobile network, here to UMTS (Universal Mobile Telecommunications System) or alternatively to a LTE network (Long Term Evolution).

In the 4 Crosses shown at the intersections of rows and columns symbolize a note in the relevant process table. If the comment is present, a process belonging to the relevant function is executed in the relevant processor. If, on the other hand, the endorsement is no longer present, then no process is performed which performs the function for which the particular line is intended.

A note 120 relates, for example, the function F1 in the processor Pr3. A note 122 relates, for example, the function F1 in the processor Pr4.

In the 4 For example, the notes shown correspond to a state in which the energy is not used efficiently because redundancy is not intentionally reduced.

With the on hand of 5 On the other hand, it is possible to purposefully reduce redundancy:

• – Vermerke für die Funktion F1 "Lenken" sind in allen Prozesstabellen eingetragen,
• – Vermerke für die Funktion F2 "ACC" (Automatic Cruising Control) sind in allen Prozesstabellen eingetragen, wenn diese Funktion aktiv ist. Alternativ sind nur Vermerke für die Prozessoren Pr1 und P2 eingetragen, wenn die Funktion "ACC" nicht genutzt wird.
• – Die Vermerke für die Funktion F3 sind alle entfernt, weil das Fahrzeug bspw. beschleunigt.
• – Vermerke für die Funktion F4 "ESP" sind in allen vier Prozesstabellen eingetragen. Alternativ kann in unkritischen Fahrsituation ein Vermerk für Prozessor Pr1 und ein Vermerk für Prozessor Pr2 ausreichen.
• – Für die Motorsteuerung/-regelung sind zwei Vermerke in den Spalten für Prozessor Pr1 und für Prozessor Pr2 vorhanden.
• – Ein Vermerk ist für die Funktion F6 (UMTS) in der ersten Spalte vorhanden, d.h. in der Spalte für Prozessor Pr1.

In an already energy-optimized state Z4 "driving", the following applies:

• - Notes for function F1 "Steering" are entered in all process tables,
• - Notes for function F2 "ACC" (Automatic Cruising Control) are entered in all process tables if this function is active. Alternatively, only notes for the processors Pr1 and P2 are entered if the function "ACC" is not used.
• - The notes for the function F3 are all removed because the vehicle, for example, accelerates.
• - Notes for function F4 "ESP" are entered in all four process tables. Alternatively, in uncritical driving situation, a note for processor Pr1 and a note for processor Pr2 suffice.
• For the motor control there are two notices in the columns for processor Pr1 and for processor Pr2.
• A note is present for the function F6 (UMTS) in the first column, ie in the column for processor Pr1.

In an operating condition Z5 the vehicle stops, for example at a traffic light. Therefore, from the second central control unit VCC2 the notes 120 and 122 away. This is permissible because when holding no or only uncritical steering movements are expected and therefore no quadruple redundancy is required. In the first two columns, however, the notes for the function F1 "Steering" still exist.

In operating state Z5, the notes for the function F2 "ACC" in the columns for the processors Pr3 and Pr4 can be removed. In the first two columns, i. in the columns for the processors Pr1 and Pr2, the notes for the function F2 remain "ACC", however. The functions F4 and F5 are provided by the processor Pr1 and Pr2, respectively. The function F6 is provided by the processor Pr1.

In an operating condition Z6 the vehicle is parked and, for example, charged via a socket. There are only two notes left in the third line, ie for loading. All other notes are deleted. Thus, the processors Pr3 and Pr4 can be turned off and the processors Pr1 and Pr2 require only a small amount of computing power.

The 5 shows a method for switching processes on and off.

The in the 5 shown process steps 200 to 212 are performed in a first variant in the central control unit VCC2.

The process begins in one process step 200 , also short as a step 200 designated. In one step 200 following step 202 the operating state of the vehicle is detected, for example from the second central control unit VCC2.

After the step 202 is from the second central control unit VCC2 the step 204 carried out. In step 204 it is checked whether the vehicle is in operating condition Z5. If the vehicle is in Z5 operating state, ie holding, then follow the step 204 immediately a procedural step 206 in which the second control unit VCC2 switches off the function F1 by removing the notes 120 and 120 in a process table or in two process tables. Thus, the function F1 is no longer executed by the processors Pr3 and Pr4.

If, on the other hand, the vehicle is not in operating state Z5, ie holding, then follow the step 204 immediately a procedural step 208 in which the second control unit VCC2 detects the operating state again.

In one step 208 following process step 210 the second control unit VCC2 checks whether the state Z4, ie driving, is active. If the vehicle is in operating state Z4, ie driving, then follow the step 210 immediately a procedural step 212 in which the second control unit VCC2 turns on the function F1, for example by entering the notes 120 and 122 in the two process tables, see 4 ,

If, on the other hand, the vehicle is not in operating state Z4, ie driving, then the step follows 210 immediately the process step again 202 ,

In a second variant, the in 3 shown method performed for the second brake control unit Bbw2. In the second variant, the process steps 200 to 212 performed in the brake control unit Bbw2.

The process starts again in one process step 200 , also short as a step 200 designated. In one step 200 following step 202 the operating state of the vehicle is detected, for example, by the second brake control unit Bbw2.

After the step 202 from the second brake control unit Bbw2 the step 204 carried out. In step 204 it is checked whether the vehicle is in operating condition Z5. If the vehicle is in Z5 operating state, ie holding, then follow the step 204 immediately a procedural step 206 in which the second brake control unit Bbw2 switches off the function ABS by removing notifications in a process table or in two process tables of the second brake control unit Bbw2. Thus, the function ABS is no longer executed by the two processors of the second brake control unit Bbw2.

If, on the other hand, the vehicle is not in operating state Z5, ie holding, then follow the step 204 immediately a procedural step 208 in which the second brake control unit Bbw2 again detects the operating state.

In one step 208 following process step 210 the brake control unit Bbw2 checks whether the state Z4, ie driving, is active. If the vehicle is in operating state Z4, ie driving, then follow the step 210 immediately a procedural step 212 in which the second brake control unit Bbw2 switches on the function ABS, for example by entering the previously removed remarks in the two process tables of the second brake control unit Bbw2.

If, on the other hand, the vehicle is not in operating state Z4, ie driving, then the step follows 210 immediately the process step again 202 ,

In an optional additional process step, for example between the process steps 202 and 204 may be at the hand of the 5 explained methods are checked whether there is still a redundancy, ie whether the central control unit VCC1 and the first brake control unit Bbw1 is still fully functional. If so, the method is performed as explained above. If, on the other hand, the central control unit VCC1 or the first brake control unit Bbw1 is no longer available, the method is aborted.

That in the 5 The procedure shown is just one example. The same functions can also be achieved by other methods, for example, a method for switching the switching states can only be called when the operating states change, so that the operating states are not must be determined constantly. Cyclical queries of the operating states are also possible.

The 6 shows the structure of a central data processing unit 300 or VCC1 of a vehicle, wherein the data processing unit 300 or VCC1 is operated on an Ethernet.

• – einen ersten Switch SW1, der gemäß Ethernetprotokoll arbeitet, und
• – einen zweiten Switch SW2, der gemäß Ethernetprotokoll arbeitet.

The central control unit 300 contains in addition to the above-mentioned processors Pr1 and Pr2, as well as the associated memory units, not shown:

• A first switch SW1 operating in accordance with Ethernet protocol, and
• A second switch SW2 operating according to Ethernet protocol.

• – dem Prozessor Pr1,
• – dem Switch SW2, und
• – einem Netzabschnitt 302.

The switch SW1 has connections to:

• The processor Pr1,
• - the switch SW2, and
• - a network section 302 ,

• – dem Prozessor Pr2,
• – dem Switch SW1, und
• – einem Netzabschnitt 304.

The SW2 switch has connections to:

• The processor Pr2,
• - the switch SW1, and
• - a network section 304 ,

For example, two network levels of the Ethernet are defined. Regarding the network section 302 the switch sends SW1 at level 1 and receives at level 2. Regarding the network section 304 It sends switch SW2 at level 2 and receives at level 1.

Thus, (R-receive) receives the control unit 300 or VCC1 data from the right in level 1, which it either processes itself or sends back to the left in level 1 (S - send). In level 2 (R-receive) receives the control unit 300 or VCC1 data from the left, which it either processes itself or resends to the right in level 2 (S - send). This topology and designation can be used to establish ring topologies or other network topologies with two directions of transmission to enable redundant data transmission. For example. a message must have been received on both levels 1 and 2 before it can be processed, triggering control actions or control operations.

In higher protocol levels TCT / IP is used in the embodiment. However, other network protocols can be used instead of Ethernet or TCP / IP.

• – Steuereinheit 300 bzw. VCC1,
• – Netzabschnitt 302,
• – fünfter Ethernet Switch SW5,
• – Netzabschnitt 304b,
• – Steuereinheit VCC2,
• – Netzabschnitt 302b,
• – sechster Ethernet Switch SW6,
• – Netzabschnitt 304.

The data processing unit VCC2 is in the embodiment of 6 as well as the data processing unit VCC1, ie it also contains two switches SW3 and SW4 in addition to the processors Pr3 and Pr4. The switch SW3 is, for example, with a network section 302b connected and the switch SW4 is connected to a network section 304b connected. The two control units VCC1 and VCC2 can be connected to an inner ring in the following order, for example:

• - Control unit 300 or VCC1,
• - Network section 302 .
• - fifth Ethernet switch SW5,
• - Network section 304b .
• - control unit VCC2,
• - Network section 302b .
• Sixth Ethernet switch SW6,
• - Network section 304 ,

In this ring topology, two transmission directions for messages are then possible. One direction in level 1 of the network and the opposite direction in level 2 of the network. Thus, there is a first redundancy. If a segment of the ring is not available, then all units can be reached via at least one of the transmission directions, which means further redundancy.

At least one further Ethernet ring can then be connected to the switches SW5 and SW6, in which case the steering control units Sbw1, Sbw2, the brake control units Bbw1 and Bbw2 and optionally further units are then connected in the same way.

The embodiments are not to scale and are not restrictive. Modifications in the context of expert action are possible. Although the invention has been further illustrated and described in detail by the preferred embodiment, the invention is not limited by the disclosed examples, and other variations can be derived therefrom by those skilled in the art without departing from the scope of the invention.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited non-patent literature

• IEEE (Institute of Electrical and Electronics Engineers Inc.) 802.3 [0031]

Claims (15)

Method for operating at least two high-availability data processing units (VCC1, VCC2), in particular in a vehicle, in which a first data processing unit (VCC1) and a second data processing unit (VCC2) can each perform at least 60 percent or at least 90 percent of the same function in which the second data processing unit (VCC2) automatically generates at least one note ( 120 . 122 ) is removed from a memory unit for a process to be executed, or is automatically put into a sleep state. The method of claim 1, wherein removing the indicia ( 120 . 122 ) or hibernation takes place depending on the operating state (Z1 to Z6) of a machine for whose operation the data processing units (VCC1, VCC2) are used, in particular a transport machine. The method of claim 2, wherein the operating state (Z1 to Z6) is detected by means of at least one sensor unit, in particular with a motion sensor, a speed sensor or a speed sensor. Method according to claim 2 or 3, wherein the operating state (1 to Z6) is the state holding (Z2, Z5), charging (Z6) of a battery or the state driving (Z1, Z3, Z4). Method according to one of the preceding claims, wherein the data processing units (VCC1, VCC2) are operated on a data transmission network (DT1, DT2) with a data transmission protocol that enables, in particular, the switching on of processors (Pr1 to Pr6) or network units (N1 to N4) an ethernet. Method according to one of the preceding claims, wherein the remote note ( 120 . 122 ) is automatically entered again by the second data processing unit (VCC2), preferably depending on the current operating state (Z1 to Z6) of the machine. Method according to one of the preceding claims, wherein the idle state is a state in which the power supply of the second data processing unit (VCC2) is turned off or in which the second data processing unit (VCC2) is disconnected from its power supply. The method of claim 7, wherein the idle state is terminated by the first data processing unit (VCC1), in particular by causing a power supply of the second data processing unit (VCC2) to be turned on or by causing the power supply of the second data processing unit (VCC2) to connect to the second data processing unit (VCC2 ). Method according to one of the preceding claims, wherein each data processing unit (VCC1, VCC2) in each case contains at least two processors (Pr1 to Pr4). Method according to one of the preceding claims, wherein the two data processing units (VCC1, VCC2) are respectively connected to two redundant data transmission connections (DT1, DT2) or data processing networks. Method according to one of the preceding claims, wherein the two data processing units (VCC1, VCC2) provide at least one core functions for controlling or regulating the machine. Method according to one of the preceding claims, wherein the two data processing units (Sbw1, Sbw2, Bbw1, Bbw2) perform at least one function in at least one peripheral subsystem of the machine. Contraption ( 10 ) for operating a machine having a first data processing unit (VCC1) and a second data processing unit (VCC2), the first data processing unit (VCC1) and the second data processing unit (VCC2) each having at least 60 percent or at least 90 percent the same functions and with a first control unit in the second data processing unit (VCC2), the first control unit having at least one note ( 120 . 122 ) for a process to be executed is removed from a memory unit or the second data processing unit (VCC2) is automatically put into a sleep state. Contraption ( 10 ) according to claim 13, having a first memory unit in the first data processing unit (VCC1), wherein it is noted in the memory unit that the first data processing unit (VCC1) takes precedence over the second data processing unit (VCC2) for providing the functions or for redundancy. Contraption ( 10 ) according to claim 13 or 14, with a first data transmission connection (DT1) or a first data processing network and with a second data transmission connection (DT2) or a second data transmission network to which the first data processing unit (VCC1) and the second data processing unit (VCC2) is connected, with at least 60 percent of the data to be transmitted or at least 90 percent of the data to be transmitted being transmitted via both data transmission links (DT1, DT2) or via both data transmission networks.

Images